Vulnerability · Published May 18, 2026 · Assigned by VulDB

CVE-2026-8802opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal

Medium 4.3

In plain English

A medium-severity path traversal in Open Source Point of Sale from opensourcepos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.

Affected products (as reported)

Vendor	Product	Versions
opensourcepos	Open Source Point of Sale	3.4.03.4.13.4.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References

VDB-364435 | opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal vdb-entry, technical-description
VDB-364435 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #802559 | opensourcepos Open Source Point of Sale 3.4.1 Path Traversal third-party-advisory
https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xq63-3v4g-39r5 broken-link
https://github.com/opensourcepos/opensourcepos/pull/4545 issue-tracking, patch
https://github.com/opensourcepos/opensourcepos/commit/def0c27a0e252668df8d942fc31e16d1edfd7323 patch